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CLAIMS 

What is claimed is: 

1 . A method comprising: 
selecting an elliptic curve; 

determining a Squared Weil pairing based on said elliptic curve; and 
cryptographically processing selected information based on said Squared 
Weil pairing. 

2. The method as recited in Claim 1, wherein said elliptic curve 
includes an elliptic curve E over a field K, wherein E can be represented as an 
equation y 2 = x 3 + ax + b. 

3. The method as recited in Claim 2, wherein determining said Squared 
Weil pairing based on said elliptic curve further includes establishing a point id 
that is defined as a point at infinity on E, and wherein P, Q, R, X are points on E 
wherein X is an indeterminate denoting an independent variable of a function, and 
wherein x{X), y{X) are functions mapping said point X on E to its affine x and y 
coordinates, and wherein a line passes through said points P, Q, R if P + Q + R 
-id. 

4. The method as recited in Claim 3, wherein when at least two of said 
P, Q, R points are equal, said line is a tangent line at a common point. 
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5. The method as recited in Claim 3, wherein determining said Squared 
Weil pairing based on said elliptic curve further includes: 

with a first function f jt p and a second function f kj p for two integers j and k, 
deriving a third function /L yHk> p based on said first and second functions. 

6. The method as recited in Claim 5, wherein {f-j-up J},p fkf ) = (f-j-k, p) 
+ (ft p) + <£ p) = 3(id) - ((-y-*)P) - (/P) - (*P). 

7. The method as recited in Claim 5, wherein f-j-kfiX) jfcK^O fkf(X) 
line(/P, AP, (-j-k)P)(X) = a constant. 

8. The method as recited in Claim 5, wherein if j is an integer and P a 
point on £*, then said first and second functions are rational functions on E whose 
divisor of zeros and poles is (fjjp) =y(P) - (jP) - (/— l)(id). 

9. The method as recited in Claim 8, wherein if j > 1 and P,jP, and id 
are distinct, then said first function has a /-fold zero at X = P, a simple pole at X = 
/P, a (/-l)-fold pole at infinity, and no other poles or zeros. 

10. The method as recited in Claim 8, wherein if j equals 0 or 1 then said 
first function is a nonzero constant. 

11. The method as recited in Claim 5, further comprising determining 
fo,p such that a line through OP = id, (-j-k)P, and (j+k)P is vertical in that its 
equation does not reference a ^-coordinate. 
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12. The method as recited in Claim 1 1 , wherein: 



r m r m ^{j^P 9 { -j-k)P)(X) 

f JP (X)\in Q {idjP-jP)(X) 



fj- k A X ) = 



f k , (X)line (-yP, kP, {j-k)P) (X) 



1 3 . The method as recited in Claim 1 1 , wherein: 
fl id = constant; 

jfc-K*) =^,K"^)*(constant); and 
if(P+Q+f?=id),then: 

r ix)r (x)f (X)= J5(WML 

M Q (jP,jQ,jR)(Xy 



14. The method as recited in Claim 3, wherein P and Q are m-torsion 
points on E and m is an odd prime, and wherein determining said Squared Weil 
pairing further includes: 

determining said squared Weil pairing based on 
/.,(Q>/..,(-*> = (pQ y 

where e w denotes the Weil-pairing. 

15. The method as recited in Claim 14, wherein neither P nor Q is an 
identity and P is not equal to ±Q. 
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16. A computer-readable medium having computer-implementable 
instructions for causing at least one processing unit to perform acts comprising: 

determining a Squared Weil pairing based on an elliptic curve; and 
cryptographically processing selected information based on said Squared 
Weil pairing. 

17. The computer-readable medium as recited in Claim 16, wherein said 
elliptic curve includes an elliptic curve E over a field K, wherein E can be 
represented as an equation^ = x + ax + b. 

18. The computer-readable medium as recited in Claim 17, determining 
said Squared Weil pairing based on said elliptic curve further includes establishing 
a point id that is defined as a point at infinity on E , and wherein P, Q, R, X are 
points on E wherein X is an indeterminate denoting an independent variable of a 
function, and wherein x(X), y(X) are functions mapping said point X on E to its 
affine x and y coordinates, and wherein a line passes through said points P, Q, R 
ifP + Q + f?=id. 

19. The computer-readable medium as recited in Claim 18, wherein 
determining said Squared Weil pairing based on said elliptic curve further 
includes: 

determining a first function fjj> and a second function f k jp for two integers j 
and k; and 

determining a third function f-j-k,P based on said first and second functions. 
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20. The computer-readable medium as recited in Claim 19, wherein 
(f-j-k,p fj,p ftp ) - if-j-KP) + (fj,p) + <M = 3(id) - ((-j-k)P) - OP) - (kP). 

21. The computer-readable medium as recited in Claim 20, wherein 
f-j-k,p(X) fjrfX) fkMX) line (/ p > *P> (~j-k)P)(X) = a constant. 

22. The computer-readable medium as recited in Claim 20, wherein if j 
is an integer and P a point on E, then said first and second functions are rational 
functions on E whose divisor of zeros and poles is (£p) =j(P) - (jP) - (/-l)(id). 

23. The computer-readable medium as recited in Claim 20, further 
comprising determining ^ 5 p such that a line through OP = id, (-j-k)P, and (j+k)P 
is vertical in that it does not reference a ^-coordinate. 



24. The computer-readable medium as recited in Claim 23, wherein: 

line ( jP, kPA-j ~k)P)(X) 
// + *p(*) = f,r(X)f tP (X) — \ , v\ ,and 

X) = fjA X )Kne{idjP-jP)(X) 
J ' kA /^(X)Kne(-7P f *P f (y-*)P)(X)" 
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25. The computer-readable medium as recited in Claim 23, wherein: 



Jjid = constant; 

fj 9 -p(X) =£K~^*(constant); and 
if(P + Q + R= id), then: 



fjA*)fj*(x)fjAx)= 



line(P,Q,R)(Xy 



\ine(jP,jQ,jR){Xy 



26. The computer-readable medium as recited in Claim 18, wherein P 
and Q are ra-torsion points on E and m is an odd prime, and wherein determining 
said Squared Weil pairing further includes: 



where e m denotes the Weil-pairing. 
27. An apparatus comprising: 

memory configured to store information suitable for use with using a 
cryptographic process; 

logic operatively coupled to said memory and configured to determine a 
Squared Weil pairing based on at least one elliptic curve, and cryptographically 
process selected information stored in said memory based on said Squared Weil 
pairing. 



determining said squared Weil pairing based on 



/ w ,p(Q)/,pW 

Ap(-0)/ w , 0 (P) 
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28. The apparatus as recited in Claim 27, wherein said logic is further 
configured to determine said elliptic curve, which includes an elliptic curve E over 
a field K, wherein E can be represented as an equation y =x + ax + b. 

29. The apparatus as recited in Claim 27, wherein said logic is further 
configured to establishing a point id that is defined as a point at infinity on E, and 
wherein P, Q, R, X are points on E wherein X is an indeterminate denoting an 
independent variable of a function, and wherein x(X), y{X) are functions mapping 
said point X on E to its affine x and y coordinates, and wherein a line passes 
through said points P, Q, R if P + Q + R = id. 

30. The apparatus as recited, in Claim 29, wherein said logic is further 
configured to determine a first function fjP and a second function f ki p for two 
integers J and and a third function f-j-k,P based on said first and second 
functions. 

31. The apparatus as recited in Claim 30, wherein {f-j-k,P fjf fkP) = 

tf-j-k?) + (ftp) + (fcp) = 3(id) - (Ct-a)P) - </P) - («>). 

32. The apparatus as recited in Claim 30, wherein f-j-k t p (X) fj,p(X) f k> p 
(X) line(/P, kP, (-j-k)P)(X) = a constant. 

33. The apparatus as recited in Claim 30, wherein if j is an integer and P 
a point on E, then said first and second functions are rational functions on E whose 
divisor of zeros and poles is (fjf ) ^j(P) - (JP) - (/-l)(id). 
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34. The apparatus as recited in Claim 30, wherein said logic is further 
configured to determine f 0 f such that a line through OP = id, {-j-k)P y and (j+k)P 
is vertical in that it does not reference a ^-coordinate. 



35. The apparatus as recited in Claim 34, wherein: 
r ,v, r /irw ,m to*(jP ,kP,(- j-k)P)(X) 

x = f hP {X)line(idjP,-jP){X) 
j ~ kA f kr {X)line^jP^P\j^k)P)(X)' 



36. The apparatus as recited in Claim 34, wherein: 
j£id = constant; 

f jr p){X) =£K~*)*(constant); and 
if (P + Q + R-id), then: 

/ (x)/ ix) r (xu M^MMiQ! 

line(yP, 7 Q, 7 i?)(X) ' 

37. The apparatus as recited in Claim 30, wherein P and Q are /w-torsion 
points on £ and m is an odd prime, and wherein said logic is further configured to 
determine said squared Weil pairing based on 



/ m ,p(Q)/ m , Q W _ , p Q y 
/ m ,p(-Q)/ ra ,oC) " mi ' j ' 

where e m denotes the Weil-pairing. 
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38. A method comprising: 

determining a Squared Weil Pairing e m (P, Q) 2 by: 

establishing an odd prime m on a curve E; and 

based on two m-torsion points P and Q on E, computing e m (P, Q) 2 . 

39. The method as recited in Claim 38, further comprising forming a 
mathematical chain for m. 

40. The method as recited in Claim 39, wherein said mathematical chain 
is selected from a group of mathematical chains comprising an addition chain and 
an addition-subtraction chain. 

41. The method as recited in Claim 39, wherein in forming said 
mathematical chain for m, every element in said mathematical chain is a sum or 
difference of two earlier elements in said mathematical chain, which continues 
until m is included in said mathematical chain. 

42. The method as recited in Claim 41, wherein said mathematical chain 
has a length 0(log(/w)). 

43. The method as recited in Claim 39, wherein for each j in said 
mathematical chain, a tuple tj = \jPjQ, n j9 dj\ is formed such that 

n j = fj*WfjA<r*) 
d j fjA-Wj, ( p ) " 
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44. The method as recited in Claim 43, wherein determining said 
Squared Weil Pairing further includes: 

starting with t x = [P, Q, 1, 1], given tj and determine by: 

forming elliptic curve sums: jP + kP = (j+k)P and 7Q + fcQ = 
(/+*)Q; 

determining line(/P, *P, (~j-k)P){X) = cO + c1*jc(X) + c2*y(X); 
determining line(/Q, jfcQ, (-y-£)Q)(X) = cO f + c1'*jc(*) + c2'*X*); 

and 
setting 

w, + *= «/^* (d> + cl*x(Q) + c2*y(Q)) * (cO' + cl'*x(P) - c?*y(P)) 

and 

4rt= 4*4* (cO + cl*x(Q) - c2*y(Q)) * (c0 f + cl'*Jt(P) + c2'*y(P)). 

45. The method as recited in Claim 44, further comprising determining 
t J+k from tj and t h wherein vertical lines through (j+k)P and (j+k)Q do not appear 
in said formulae for and dj+k when contributions from Q and -Q are equal, 
and wherein -Q is the complement of Q and when contributions from P and -P 
are equal, and wherein -P is the complement of P. 

46. The method as recited in Claim 44, wherein if j + A: = m, then = 
n, * rc* and */y+* = 4 * 
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47. A computer-readable medium having computer-implementable 
instructions for causing at least one processing unit to perform acts comprising: 

determining a Squared Weil Pairing eJP, Q) 2 by: 
establishing an odd prime m on a curve E; and 
based on two m-torsion points P and Q on E, computing e m (P, Q) 2 . 

48. The computer-readable medium as recited in Claim 47, further 
comprising forming a mathematical chain for m selected from a group of 
mathematical chains comprising an addition chain and an addition-subtraction 
chain, such that every element in said mathematical chain is a sum or difference of 
two earlier elements in said mathematical chain, which continues until m is 
included in said mathematical chain. 

49. The computer-readable medium as recited in Claim 48, wherein for 
each j in said mathematical chain, a tuple tj = \jPjQ, dj] is formed such that 

Hi = fjA*)fj*W 

dj fjA'Q)fj*( p Y 

50. An apparatus comprising: 

memory configured to store information suitable for use with using a 
cryptographic process; 

logic operatively coupled to said memory and configured to determine a 
Squared Weil Pairing eJJP, Q) 2 by establishing an odd prime m on a curve E, and 
based on two /w-torsion points P and Q on E, computing e m (P, Q) 2 . 



Iee@hayes pot 509-324-92se 



41 



MSI- 1 276US. PA T.APP 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 



51. The apparatus as recited in Claim 50, wherein said logic is further 
configured to form a mathematical chain for m that is selected from a group of 
mathematical chains comprising an addition chain and an addition-subtraction 
chain. 



52. The apparatus as recited in Claim 51, wherein for each j in said 
mathematical chain, said logic is further configured to form a tuple tj = [/P,yQ, rij, 
dj] such that 

» J= fjA*)fj*W 
d j fjA-Q)fj*( p Y 



53 . A method comprising: 

determining a Squared Weil pairing (m, P, Q), where m is an odd prime 
number, by setting t\ = [P, Q, 1, 1], using an addition-subtraction chain to 
determine t m =[mP, mQ, n my d m ], and if n m and d m are nonzero, then determining: 

n m _ / CT ,p(Q)/ m , Q (-P) , and 
d m /„,p(-0)/„,o(P)' 

cryptographically processing selected information based on said Squared 
Weil pairing. 
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54. A computer-readable medium having computer-implementable 
instructions for causing at least one processing unit to perform acts comprising: 

determining a Squared Weil pairing (w, P, Q), where m is an odd prime 
number, by setting t x = [P, Q, 1, 1], using an addition-subtraction chain to 
determine t m =[mP, mQ, n m , d m ], and if n m and d m are nonzero, then determining: 



cryptographically processing selected information based on said Squared 
Weil pairing. 

55. An apparatus comprising: 

memory configured to store information suitable for use with using a 
cryptographic process; 

logic operatively coupled to said memory and configured to: 

determine a Squared Weil pairing (m, P, Q), where m is an odd 
prime number, by setting t\ = [P, Q, 1, 1], 

use an addition-subtraction chain to determine t m =[mP, mQ, n m , d m ], 

if n m and d m are nonzero, then determine 



cryptographically process selected information based on said 
Squared Weil pairing. 



d m LA-<*)f m *PY 



; and 



^_ L,p(Q)AoW . 

d m ^p(-Q)^a(P) , 



; and 
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56. A method comprising: 
selecting an elliptic curve; 

determining a Squared Tate pairing based on said elliptic curve; and 
cryptographically processing selected information based on said Squared 
Tate pairing. 

57. The method as recited in Claim 56, wherein said elliptic curve 
includes an elliptic curve E over a field K, wherein E can be represented as an 

2 3 

equation;; = x + ax + b. 

58. The method as recited in Claim 56, wherein m is an odd prime on K 
and P is an ra-torsion point on £, Q is a point on E, with neither P nor Q being the 
identity and wherein P is not equal to a multiple of Q, and wherein E is defined 
over K 9 Kh&s q=p n elements, and m divides q-l, then determining that 

f/,.,(Q)f .„ (p Q) 

where v m denotes the squared Tate-pairing. 
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59. The method as recited in Claim 56, wherein determining said 
Squared Tate pairing includes determining v w (P, Q) by: 

establishing an odd prime m and said elliptic curve E; 
given an m-torsion point P on E and a point Q on E, determining a 
mathematical chain for m; and 

for each j in said mathematical chain, forming a tuple tj = [/P, <j£] such 

that 

»j = 4p(g) 

60. The method as recited in Claim 59, further comprising: 
starting with fj = [P, 1 5 1], given £ and determining by: 

forming an elliptic curve sum yP + kP = (j+k)P, 

determining line(/P, *P, (~j-k)P)(X) = cO + c1*jc(JC) + c2*y(J(), 

and 

setting: = w, * n k * (cO + cl*x(Q) + c2*y(Q)) and 
4+* = dj * <4 * (cO + c1*jc(Q) - c2*XQ)). 

61. The method as recited in Claim 60 further comprising determining 
tj-k from tj and ^. 

62. The method as recited in Clam 61 , wherein if j+k=m, then: 
nj+k = «/ * and = </ y * 
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63. The method as recited in Claim 61, wherein if n m and d m are 
nonzero, then: 

*. = LAO) 

64. The method as recited in Claim 56, wherein said mathematical chain 
is selected from a group of mathematical chains comprising an addition chain and 
an addition-subtraction chain. 

65. A computer-readable medium having computer-implementable 
instructions for causing at least one processing unit to perform acts comprising: 

determining a Squared Tate pairing based on an elliptic curve; and 
cryptographically processing selected information based on said Squared 
Tate pairing. 

66. The computer-readable medium as recited in Claim 65, wherein said 
elliptic curve includes an elliptic curve E over a field K, wherein E can be 
represented as an equation^ = x + ax + b. 
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67. The computer-readable medium as recited in Claim 65, wherein m is 
an odd prime on K and P is an m-torsion point on E, Q is a point on E, with 
neither P nor Q being the identity and wherein P is not equal to a multiple of Q, 
and wherein E is defined over K, K has # = p n elements, and m divides q-l, then 
determining that 

q-l 

=v m (P,Q), 



/„,p(0) 



where v m denotes the squared Tate-pairing. 

68. The computer-readable medium as recited in Claim 65, wherein 
determining said Squared Tate pairing includes determining vJP, Q) by: 

establishing an odd prime m and said elliptic curve E; 

given an w-torsion point P on E and a point Q on E, determining a 
mathematical chain for m\ and 

for each j in said mathematical chain, forming a tuple tj = [/P, n j9 dj] such 



that 



d j fjA-<*y 
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69. An apparatus comprising: 

memory configured to store information suitable for use with using a 
cryptographic process; 

logic operatively coupled to said memory and configured to determine a 
Squared Tate pairing based on an elliptic curve; and 

cryptographically processing selected information based on said Squared 
Tate pairing. 

70. The apparatus as recited in Claim 69, wherein said elliptic curve 
includes an elliptic curve E over a field K 9 wherein E can be represented as an 
equation;; = x + ax + b. 

71. The apparatus as recited in Claim 69 wherein m is an odd prime on 
K and P is an m-torsion point on £, Q is a point on E, with neither P nor Q being 
the identity and wherein P is not equal to a multiple of Q, and wherein E is 
defined over K, K has q =p n elements, and m divides q-\ , then determining that 




q-\ 



where v m denotes the squared Tate-pairing. 
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72. The apparatus as recited in Claim 69, wherein said logic is further 
configured to: 

establish an odd prime m and said elliptic curve E; 

given an m-torsion point P on E and a point Q on E, determine a 
mathematical chain for m; and 

for each j in said mathematical chain, form a tuple tj = \jP, rip dj\ such that 

dj / y ,p(-Q) 4 
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